PassBy[ME] - Bugzilla integration on

Transcription

1 PassBy[ME] - Bugzilla integration on CentOS 6.5 operating system Document id: PBM_06 Version: 1.2 Author: Microsec Ltd. Date: February 2,

2 Table of contents 1 Introduction PassBy[ME] and Bugzilla architecture Installation of Bugzilla enviroment Operating System Network requirements PassBy[ME] account General operating system level operations Turn off syslog rate Turn off SELinux settings Enable Firewall Ports Required software components Installing Apache HTTP server Installing mod_ssl Apache module (optional) MySQL database Installing MySQL database Starting MySQL database Installing Perl enviroment Installing Bugzilla Creating directory structure Download Bugzilla Add PassByMe extension modul Installing necessary Perl modules Configure Bugzilla Configure Apache HTTP Server Configuring PassByMe second factor for Bugzilla

3 4.1 Setting authentication PFX Configure PassByMe on Bugzilla administration page Set PassBy[ME] configuration parameters Set PassBy[ME] CGI interface Turning off PassBy[ME] second factor authentication Creating other users

4 1 Introduction This documentation assumes that you are familiar with the basic working model of PassBy[ME] API interface and gives a detailed step by step tutorial to integrate the PassBy[ME] second channel authentication service into a free, and widespread webapplication. This document will describe the main technical characteristics to integrate the PassyBy[ME] second factor authentication mechanism into a Bugzilla Bug- Tracking system as a Service Provider (SP). 1.1 PassBy[ME] and Bugzilla architecture API interface trough certificate based authentication HTTPS channel PUB Server Bugzilla Certificate based Bug-Tracking System authentication HTTPS channel PassByMe Service HTTPS channel SCEP Server User MQTT Broker 4

5 2 Installation of Bugzilla enviroment Do all of the following steps with root rights!! 2.1 Operating System This document describes the installation process on a physical or virtual server machine with installed CentOS operating system. Version: CentOS release 6.5 (Final) x86-64 If you would like to integrate the PassBy[ME] second factor into Bugzilla, you can choose another system which is supported by Bugzilla. 2.2 Network requirements The physical or virtual server machine has to be connected to the internet. Ensure network availability to the PassBy[ME] Authentication API: The PassBy[ME] test service: Web based administration interface: Authentication API webservice: Management API webservice: The PassBy[ME] production service: Web based administration interface: Authentication API webservice: Management API webservice: PassBy[ME] account You'll need a PassBy[ME] account, an application key (ID) and a certificate to integrate you application into PassBy[ME]. To get this account data do the following steps: 1. Sign up for a PassBy[ME] account on the web based administration interface, and register a new organization if you haven t registered before. If you have already registered into the PassBy[ME] service, 5

6 please log in as an administrator with your previously created credential data (username/password and your PassBy[ME] ready mobile device). 2. Create a new Application under this organization by selecting "Register new Application" under the "Application" navigation menu. This will generate an application key (UUID). 3. Download and save the certificate by clicking on "Download PFX" under the "Application" navigation menu. Save the pfx s password by clicking the Show PFX password button. Client certificate authentication is enforced by the server. In order to have PassBy[ME] second factor you are required to use your authentication certificate during all PassBy[ME] second factor requests. 2.4 General operating system level operations Turn off syslog rate Create: /etc/rsyslog.d/noratelimit.conf $SystemLogRateLimitInterval 0 Reloading syslog configuration /etc/init.d/rsyslog reload Turn off SELinux settings Modifying /etc/sysconfig/selinux SELINUX=disabled Next step: reboot the system Enable Firewall Ports Installing system_config_firewall program yum install system_config_firewall-tui system-config-firewall-tui Trusted Services: www (HTTP) (80) www (HTTPS) (443) 6

7 2.5 Required software components The following software components should be installed on CentOS 6.5 operating system to run the Bugzilla application: Apache webserver (version ) MySQL Database (version: 5.1.x MySQL Community Server (GPL)) Perl Bugzilla Bug-Tracking System (version: 4.4.6) Perl modules for Bugzilla OpenSSL (built in) curl (built in) The next chapters will describe the step by step instructions for installing the necessary software components. 2.6 Installing Apache HTTP server Version: yum install apr el6_2.x86_64 apr-util el6_0.1.x86_64 httpdtools el6.centos.x86_64 apr-util-ldap el6_0.1.x86_64 httpd el6.centos.x86_64 Installing c_rehash yum install openssl-perl Installing mod_ssl Apache module (optional) yum install mod_ssl Setting mod_ssl parameters The content of /etc/httpd/conf.d/ssl.conf Listen 443 LoadModule ssl_module modules/mod_ssl.so SSLPassPhraseDialog builtin SSLSessionCache shmcb:/var/cache/mod_ssl/scache(512000) SSLSessionCacheTimeout 300 SSLMutex default SSLRandomSeed startup file:/dev/urandom 512 7

8 SSLRandomSeed connect file:/dev/urandom 512 SSLCryptoDevice builtin SSLHonorCipherOrder On SSLCipherSuite RC4:HIGH:MEDIUM:+TLSv1:!EDH:!aNULL:!eNULL:!LOW:!EXPORT:!ADH:!SSL v2 SSLProtocol all -SSLv2 SSLv3 2.7 MySQL database Version: 5.1.x MySQL Community Server (GPL) Create /etc/my.cnf (if not exist) [mysqld] datadir=/var/lib/mysql socket=/var/lib/mysql/mysql.sock user=mysql # Disabling symbolic-links is recommended to prevent assorted security risks symbolic-links=0 [mysqld_safe] log-error=/var/log/mysqld.log pid-file=/var/run/mysqld/mysqld.pid Installing MySQL database MySQL database enviroment installation process yum install mysql-server mysql yum install mysql-libs yum install unixodbc yum install mysql-connector-odbc yum install mysql-devel Starting MySQL database /etc/init.d/mysqld start 8

9 2.8 Installing Perl environment Create symlink to Perl interpreter cd /usr/local/bin ln -s /usr/bin/perl. Installing enviroment yum install perl-cpan yum install perl-xml-parser yum install perl-yaml yum install perl-xml-twig yum install mod_perl yum install perl-cgi-session yum install gcc autoconf automake bison flex libtool glibc-devel zlib-devel kernel-headers expat expat-devel 9

10 3 Installing Bugzilla The Bugzilla Bug-Tracking application is a free Software which can be downloaded from the following website: See the Bugzilla Guide Release: The PassBy[ME] capable version is: ( ) Do all of the following steps with root rights!! 3.1 Creating directory structure mkdir -p /msc/srv/www/bugzillademo/htdocs mkdir p /msc/srv/www/bugzillademo/pfx 3.2 Download Bugzilla cd /msc/srv/www/bugzillademo/htdocs wget tar xfz bugzilla tar.gz ln -s bugzilla bugzilla 3.3 Add PassBy[ME] extension module mkdir -p /msc/srv/www/bugzillademo/src cd /msc/srv/www/bugzillademo/src Download PassByMe2FA Perl client package: tar.gz Download PassByMe2FA Bugzilla extension package: 10

11 tar xzf passbyme2fa-client-perl-1.00.tar.gz tar xzf passbyme2fa-extension-1.00.tar.gz <<Now you have this content tree in the directory >> /msc/srv/www/bugzillademo/src/ bugzilla-passbyme2fa-extension/ bugzilla factor2-auth-hooks.patch PassByMe2FA/ Config.pm Extension.pm lib/ template/ web/. passbyme2fa-client-perl-1.00/ PassByMe2FA/ passbyme2fa.pl Copy PassByME2FA Perl client library to Bugzilla lib directory cp -r passbyme2fa-client-perl-1.00/passbyme2fa /msc/srv/www/bugzillademo/htdocs/bugzilla/lib Copy PassByMe2FA Bugzilla extension to Bugzilla extension directory cp -r bugzilla-passbyme2fa-extension/passbyme2fa /msc/srv/www/bugzillademo/htdocs/bugzilla/extensions Patch Bugzilla to enable PassByMe 2FA integration cd /msc/srv/www/bugzillademo/htdocs/bugzilla patch -p1 <../../src/bugzilla-passbyme2fa-extension/bugzilla factor2- auth-hooks.patch You will see this line on standard output: patching file Bugzilla/Auth.pm 11

12 3.4 Installing necessary Perl modules cd /msc/srv/www/bugzillademo/htdocs/bugzilla./checksetup.pl --check-modules ( In case of Can't locate version.pm run the following commands: perl -MCPAN -e shell cpan> install version ) Install the missing perl modules. cd /msc/srv/www/bugzillademo/htdocs/bugzilla /usr/bin/perl install-module.pl all Run again the./checksetup.pl (without --check-modules) cd /msc/srv/www/bugzillademo/htdocs/bugzilla./checksetup.pl 3.5 Configure Bugzilla Create database [root]#mysql mysql> create database passbyme_bugzilla character set utf8; mysql> grant all privileges on passbyme_bugzilla.* to 'pbm_bugzilla'@'localhost' identified by 'tmbyxk85#'; Edit Bugzilla config file cd /msc/srv/www/bugzillademo/htdocs/bugzilla vim localconfig Set the following parameters in localconfig $create_htaccess = 1; $webservergroup = 'apache'; $use_suexec = 0; $db_driver = 'mysql'; 12

13 $db_host = 'localhost'; $db_name = 'passbyme_bugzilla'; $db_user = 'pbm_bugzilla'; $db_pass = 'tmbyxk85#'; $db_port = 0; $db_sock = ''; $db_check = 1; $index_html = 0; $cvsbin = '/usr/bin/cvs'; $interdiffbin = ''; $diffpath = '/usr/bin'; Run again the./checksetup.pl (without --check-modules) cd /msc/srv/www/bugzillademo/htdocs/bugzilla./checksetup.pl If you the script can connect to the mysql database, you will be prompted to give some data (administrator , full name, password). Important: Your administrator will be your login name which have to be the same as your PassBy[ME] ID, which is registered in the PassBy[ME] system. 3.6 Configure Apache HTTP Server Edit the httpd.conf file cd /etc/httpd/conf vim httpd.conf Create VirtualHost at the and of the default httpd.conf file <VirtualHost *:80> ServerName bugzillademo.test.com ServerAlias bugzillademo2.test.com DocumentRoot /msc/srv/www/bugzillademo/htdocs ErrorLog logs/bugzillademo. test.com -error_log CustomLog logs/bugzillademo.test.com -access_log common RewriteEngine On RewriteRule ^/(bugzilla)?$ /bugzilla/ [R,L] 13

14 <Directory /msc/srv/www/bugzillademo/htdocs> AddHandler cgi-script.cgi Options +ExecCGI DirectoryIndex index.cgi index.html AllowOverride Limit FileInfo Indexes Options Allow from all </Directory> </VirtualHost> Start Apache http server /etc/init.d/httpd start Now you can access the installed Bugzilla website on the following url: 14

15 4 Configuring PassByMe second factor for Bugzilla 4.1 Setting authentication PFX See chapter PassBy[ME] account to know how you can have a PFX key file for using PassBy[ME] service. Copy the authentication pfx file to the following file path cd /msc/srv/www/bugzillademo/pfx/ cp <file>.pfx. 4.2 Configure PassBy[ME] on Bugzilla administration page Log in to Bugzilla as administrator Set PassBy[ME] configuration parameters Navigate to the Administration/Parameters/PassByMe2FA menu, and set the parameters below Name of the parameter passbyme2fa_enabled passbyme2fa_server_urlbase Description When this options is turned on, PassByMe 2nd factor authentication is enabled. The URL base of the PassByMe2FA server. For testing use the following url: passbyme2fa_application_id PassByMe2FA Application Id of this Bugzilla system. e.g.: 99d163df-efe8-4d58-8cb2-a8f3a76d5d84 passbyme2fa_auth_cert_pfx_file_path Path of the PFX file which contains the PassByMe2FA authentication certificate and key. e.g.: /msc/srv/www/bugzillademo/pfx/<file>.pfx passbyme2fa_auth_cert_pfx_password passbyme2fa_communication_timeout Password of the PFX file. Timeout (in seconds) for PassByME2FA server communication. e.g.: 10 passbyme2fa_status_refresh_interval Refresh interval (in seconds) of PassByMe2FA pending status page. e.g.: 2 15

16 passbyme2fa_authentication_message PassByMe2FA authentication message. {username} will be replaced with the username you are trying to log in with. This message will be shown during the authentication process in the PassBy[ME] application on the mobile device. e.g.: You are trying to authenticate to bugzillademo.test.com as user {username} Set PassBy[ME] CGI interface Navigate to the Administration/Parameters/User Authentication Name of the parameter user_info_class Description Mechanism(s) to be used for gathering a user's login information. More than one may be selected. If the first one returns nothing, the second is tried, and so on. Set the value of select to: CGI.PassByMe2FA Press Save Changes at the bottom of the page. Now your Bugzilla application is PassBy[ME] ready. During next log in you have to use your mobile device Turning off PassBy[ME] second factor authentication If you are the administrator, and you have lost your mobile device, you can t log in into the Bugzilla system. In this case, you can turn off the using of PassBy[ME] second factor at server side. Edit PassBy[ME] configuration file (use your file editor) /msc/srv/www/bugzillademo/bugzilla/extensions/passbyme2fa/ Config.pm Set AUTHENTICATION_DISABLED to 1 use constant AUTHENTICATION_DISABLED => 1; 16

17 Restart Apache webserver /etc/init.d/httpd restart Now you can log in without using PassBy[ME] second factor. At the Administration/Parameters/PassByMe2FA menu you will give the following alert message, if the PassByMe2FA was turned on trough the webpage before Creating other users If you create other users in the Bugzilla Bug-Tracking System, you should give for each user the same username as their PassBy[ME] ID in the PassBy[ME] system. 17